When It’s Okay to Disclose PHI and When It’s Not

In some cases, you have more latitude than might expect when it comes to releasing protected health information (PHI); in other case, you need to be cautious. To keep things running smoothly you need to know the basics, and know where to go for help when things aren't so clear. "Because HIPAA is so complicated, people often over cover, but unnecessary caution can gum up the works," said Laurie Morgan, partner and senior consultant at Capko & Morgan, a San Francisco, Calif., medical consulting firm. On the other hand, she said,  what seems like a perfectly harmless disclosure can get you in trouble.

There are a few scenarios where you can disclose PHI without patient consent: coroner's investigations, court litigation, reporting communicable diseases to a public health department, and reporting gunshot and knife wounds. While these are pretty straightforward, a few situations where disclosure without consent is legal can be a little trickier: justifiable disclosures in the public interest, disclosures to protect the patient or others from harm, reporting abuse and neglect. This last batch can require a fair bit of professional judgement, but HIPAA is more amenable to this than you may think.

For example, after the Orlando nightclub shootings there was initially some concern about who hospital staff could share information with about the victims being treated. This was especially tricky in this case because the closest family members of LGBT patients aren't always legally related to them. HHS made it clear that "family" is a broad category and the interests of the patients, as determined by the healthcare providers, allowed for disclosure to loved ones, legally related or not. No waiver of HIPAA was necessary. Nonetheless in any situation where you feel you are stepping rather close to a HIPAA line, "It is important to keep in mind the guidelines that say 'minimum information necessary.' Limit the information to what has to be disclosed," said Rick Hindmand, a healthcare attorney with McDonald Hopkins in Chicago, Ill. Hindmand also added that you need to keep a record of any disclosures you make. 

In other cases, you can be tripped up by making assumptions about traditional families. In general, either parent of a minor that is not emancipated is entitled to information about and to make medical decisions for the child. However, divorces and unusual custody situations can occasionally cause problems. "Usually both parents, even when divorced, are entitled to make decisions for a child, but in some cases parental rights have been taken away," said Hindmand. If you have any doubts about the custody situation of young patients, tread carefully.

Much of the stress and worry of complicated situations like these can be relieved by simply checking the frequently asked questions on the HHS website. "Many of these problems have come up before," said Morgan. "As you dig in and read the FAQs, you'll find that they provide a lot of help." The person you have designated as security officer should spend some time becoming familiar with these FAQs, advised Hindmand. The answer to a tricky question may be easy to find without having to call your attorney.